Communication with those charged with governance is not a ceremonial step at the end of an audit. Under ICAI's Revised SA 260, it is a structured two-way process that helps the auditor explain responsibilities, planned audit scope, significant risks and important findings while also obtaining information that may affect the audit. The practical first step is to identify who actually performs the governance role for the entity.
ICAI's current Engagement and Quality Control Standards repository lists Revised SA 260 as part of the current Standards on Auditing suite. The Institute also provides the official SA 260 (Revised) text, which sets out the required communication matters, timing, form and documentation.
Who are “those charged with governance”?
SA 260 describes those charged with governance as the person or group responsible for overseeing the entity's strategic direction and accountability obligations, including oversight of the financial reporting process. Depending on the entity, this may be the board of directors, an audit committee, partners, trustees, proprietors or another governing body.
The auditor should determine the appropriate person or persons within the governance structure with whom to communicate. If communication is made only to a subgroup, such as an audit committee, the auditor must consider whether the matter also needs to reach the full governing body. In a small owner-managed entity where the same person performs management and governance roles, duplicate communication is not required if that person has already been adequately informed in the governance capacity.
What must the auditor communicate?
1. Auditor responsibilities
The auditor communicates that the auditor is responsible for forming and expressing an opinion on financial statements prepared by management with governance oversight. The audit does not relieve management or those charged with governance of their own responsibilities. This distinction matters because governance communication should not create the impression that the auditor owns the financial reporting process.
2. Planned scope, timing and significant risks
SA 260 requires an overview of the planned scope and timing of the audit, including significant risks identified by the auditor. The discussion should help governance understand where the audit is expected to focus, when major phases will occur and where oversight attention may be especially useful, without making audit procedures predictably detailed.
Example: if revenue recognition is identified as a significant risk, the auditor may explain that year-end revenue, cut-off, unusual contracts and manual adjustments will receive focused attention. The communication should describe the audit focus without giving management a step-by-step testing script.
3. Significant findings from the audit
The auditor must communicate significant findings relevant to governance oversight. These include significant qualitative aspects of accounting practices, including accounting policies, accounting estimates and financial statement disclosures. Where an accounting practice is technically acceptable but, in the auditor's view, not the most appropriate in the entity's circumstances, that view should also be communicated.
Other required areas include significant difficulties encountered during the audit, significant matters discussed or corresponded about with management where those charged with governance are not all involved in management, written representations being requested, circumstances affecting the form and content of the auditor's report, and other significant matters that are relevant to oversight of financial reporting.
4. Auditor independence for listed entities
For listed entities, SA 260 requires specific independence communication. The auditor communicates compliance with relevant ethical requirements on independence and relationships or other matters that may reasonably be thought to bear on independence, together with related safeguards. The standard also requires appropriate fee information for audit and non-audit services in this listed-entity communication.
When should communication happen?
The standard requires communication on a timely basis. That normally means the process should run through the engagement rather than being saved for a single closing meeting. Planning matters belong early enough to influence governance oversight. Significant difficulties or emerging findings should be raised when they become relevant. Final reporting matters should be discussed in time for governance to understand their effect before the auditor's report is issued.
A practical approach is to use three stages:
- Planning stage: agree communication channels, identify the appropriate governance recipients, explain auditor responsibilities, discuss planned scope and timing, and communicate significant risks.
- Fieldwork stage: escalate significant difficulties, contentious accounting issues and other matters requiring governance attention while there is still time to respond.
- Completion stage: communicate significant findings, requested written representations, unresolved matters, independence information where applicable and reporting implications.
Does every matter have to be in writing?
No. SA 260 does not require every communication to be written. However, significant findings must be communicated in writing when, in the auditor's professional judgment, oral communication would not be adequate. Independence communications required for listed entities are also made in writing. Written communications do not need to repeat every matter that arose during the audit.
The objective is effective governance communication, not a standard template regardless of the engagement. The form should make the matter understandable, appropriately formal and traceable.
What should be documented?
If a required matter is communicated orally, the audit documentation should record what was communicated, when it was communicated and to whom. If the communication is in writing, a copy should be retained as part of the audit documentation. The auditor must also evaluate whether the two-way communication process was adequate for the audit.
If communication is ineffective, SA 260 requires the auditor to consider the effect on risk assessment and the ability to obtain sufficient appropriate audit evidence, and to take appropriate action.
Practical SA 260 checklist
- Identify the actual governance body or person before planning communications.
- Decide whether communication with an audit committee alone is sufficient or whether the full governing body also needs the information.
- Communicate auditor responsibilities and make clear that management retains responsibility for preparing the financial statements.
- Discuss planned scope, timing and significant risks early enough to be useful.
- Escalate significant difficulties and important accounting or reporting issues promptly.
- At completion, communicate significant findings, requested representations and reporting implications.
- For listed entities, complete the required written independence communication.
- Document oral communications and retain copies of written communications.
- Assess whether the communication process was genuinely two-way and effective.
Common mistakes to avoid
- Treating SA 260 as a year-end checklist instead of an engagement-wide communication process.
- Sending every issue to management but failing to communicate matters that require governance oversight.
- Assuming an audit committee discussion automatically eliminates the need to inform the full board.
- Giving so much procedural detail at planning that audit work becomes predictable.
- Leaving major accounting disagreements or audit difficulties until report-signing day.
- Relying on undocumented oral conversations for significant matters.
- Confusing SA 260 with SA 265: SA 260 is the broader governance-communication framework, while SA 265 specifically addresses identified internal-control deficiencies.
Practical takeaway
A strong SA 260 process is built around the right recipient, the right matter, the right timing and an evidence trail showing what was communicated. Start by mapping the governance structure, then communicate responsibilities, planned scope and significant risks, keep governance informed of significant findings during the audit, complete listed-entity independence requirements where applicable, and document the process. Effective two-way communication supports better audit evidence and better financial reporting oversight; it should not be reduced to a generic closing memo.
